CVE-2017-10271 Oracle Corporation WebLogic Server Remote Code Execution
Unauthenticated attackers can compromise Oracle WebLogic Server via T3 protocol, leading to server takeover and denial of service.
- Exploited in the wild
- Since 10 Feb 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-10271?
CVE-2017-10271 is a high-severity authentication bypass vulnerability in Oracle Weblogic Server, published on 19 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Security). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Weakness: CWE-306
Which versions are affected by CVE-2017-10271?
It affects 1 product.
Products include Oracle Weblogic Server.
How do I fix CVE-2017-10271?
No fix has been published for CVE-2017-10271 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2022.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-10271 being exploited?
Yes. Attackers have exploited CVE-2017-10271 in the wild since at least 10 Feb 2022, including in ransomware campaigns.
Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 30 proofs of concept on GitHub.
Other vulnerabilities in Oracle Weblogic Server
Sources
Also known as GHSA-h7p4-68h5-84f3.